UK Gambling Sites Take One Click to Accept Tracking. Some Take Fifteen to Refuse It.

Click "Accept All" on a UK gambling site and the banner disappears in a beat. Try to refuse instead, and on some sites you will click through as many as fifteen separate screens to get there. That asymmetry is not an accident. It is the finding at the center of a new audit from Swansea University's Gambling Research, Education and Treatment Centre, which checked cookie consent banners on all 624 casino and sports betting sites licensed by the UK Gambling Commission and found 86 percent operating in breach of European data protection law.

The lead researcher, PhD student Jack McGarrigle, worked with professors Simon Dymond, Martyn Quigley, and Jamie Torrance to audit the sites' network traffic alongside their consent pop-ups. Sixty-seven percent of the sites sent unique identifiers to advertising and analytics platforms before a visitor had clicked anything. Twenty-four percent offered no way to refuse tracking at all, and two percent skipped the consent banner altogether.

How the banners get you to say yes

The audit sorted the deceptive designs into specific categories, not just a general impression of unfairness. Sixty percent of banners visually emphasized the accept button with color or size while leaving the reject option plain. Forty-seven percent buried the reject choice behind a second click, a settings menu the visitor had to go looking for. Twenty-nine percent arrived with privacy-unfriendly options already pre-selected, so doing nothing counted as consent.

“Most aren't giving customers a fair choice about tracking. Some make it a single click to accept and up to fifteen to refuse.”

The experiment that proved the trick works

A finding about banner design is one thing. Proving it changes behavior is another, so the team ran a second study with 615 UK online gamblers, showing each person a simulated betting site with one of six different consent banner designs. People shown the industry-standard version, the one with the emphasized accept button and the buried reject option, were three to four times more likely to accept tracking than people shown a neutral design. Afterward, participants who had accepted tracking rated their choice as matching their actual preference at 4.4 out of 10. Participants who had rejected it rated the match at 7.9.

“The data being harvested through these designs isn't neutral, it's the same kind of behavioural signal that can flag risk.”

Gambling sites are worse than most, not unusual

Dark patterns are not unique to betting sites. A 2019 Princeton University crawl of more than 11,000 shopping websites found deceptive design on about 11 percent of them, mostly nudges toward buying more or signing up for subscriptions. The Swansea audit measured something narrower, consent to tracking rather than deceptive sales tactics, but the gap is still wide: 86 percent of gambling sites breaching consent rules against roughly one in nine shopping sites using dark patterns of any kind seven years earlier. The Swansea team did not audit sites outside the UK or outside gambling, so the comparison is a snapshot, not an industry-wide trend line.

GDPR already requires that saying no be as easy as saying yes. The Swansea audit is evidence that across most of one entire regulated sector, it currently is not, and that sites ignoring the rule get exactly the outcome they were built for: more accepted tracking, on people whose betting activity is itself the kind of signal companies have reason to want. Neither the Information Commissioner's Office nor the Gambling Commission is quoted responding to the findings in the university's release, so what happens to the 86 percent now is still an open question, not one this study answers.